After finishing this lesson, you will be able to confidently do the following three things.

• ▸✅ Map OSI 7 layers vs. TCP/IP 4 layers
• ▸✅ Explain the precise concepts of IP, Port, and Socket
• ▸✅ Describe how DNS works (Recursive → Root → TLD → Authoritative)

Keep the learning objectives as a checklist and close the lesson once you can answer all of them.

In one line: A network is the postal system of the world's computers. IP (address) + DNS (name) + Port (room number) + TCP/UDP (delivery method).

4 Core Elements:

Anatomy of a URL:

https://api.codemaster40.com:443/users/42?ref=home
└─ ─┘   └────────────────┬─────────┘ └┬┘ └──┬───┘ └──┬──┘
  │              host              port  path     query
  └─ protocol (TCP+TLS=HTTPS)

The journey of a single request:
1. DNS lookup: codemaster40.com → IP 1.2.3.4
2. Connect via TCP 3-way handshake
3. Encrypt via TLS handshake
4. HTTP request and response
5. Close with TCP 4-way handshake

IPv4 (32-bit) — roughly 4.3 billion addresses. Not enough!

• ▸Example: 192.168.1.10 = 4 octets × 8 bits
• ▸Class A · B · C — legacy approach (no longer used)
• ▸Replaced by CIDR

CIDR (Classless Inter-Domain Routing):

192.168.1.0/24      → 192.168.1.0 ~ 192.168.1.255 (256 IP)
192.168.0.0/16      → 192.168.0.0 ~ 192.168.255.255 (65,536)
10.0.0.0/8          → 10.0.0.0 ~ 10.255.255.255 (16,777,216)

• ▸/24 = the first 24 bits are the network ID; the remaining 8 bits are the host
• ▸A fundamental concept for infrastructure such as AWS VPC and K8s pod CIDRs

Private IP ranges (not routable on the internet; for private networks):

• ▸10.0.0.0/8
• ▸172.16.0.0/12
• ▸192.168.0.0/16

NAT (Network Address Translation) — solves IPv4 exhaustion:

• ▸Multiple devices on a private network share one public IP
• ▸The router records a port mapping when sending packets
• ▸When a response arrives, the port is used to forward it to the original device

[My PC 192.168.1.10:55012] → [Router 1.2.3.4:55012] → External server
                                        ↓ NAT table stored
Response: External → 1.2.3.4:55012 → 192.168.1.10:55012

IPv6 (128-bit) — virtually infinite (340 trillion × trillion × trillion...).

• ▸2001:0db8:85a3:0000:0000:8a2e:0370:7334
• ▸The standard for IoT and 5G. As of 2025, IPv6 accounts for 50%+ of internet traffic.

DNS = Name-to-IP translation system (a globally distributed database):

Lookup flow:
1. Check browser cache
2. OS cache (/etc/hosts)
3. Local DNS server (ISP · Google 8.8.8.8 · Cloudflare 1.1.1.1)
4. Root (.) → Where is .com? → Points to the TLD server
5. TLD (.com) → Where is codemaster40.com? → Points to the Authoritative server
6. Authoritative → Returns the actual IP
7. Cache the result (for the duration of the TTL)

DNS record types:

• ▸A — IPv4 mapping (example.com → 1.2.3.4)
• ▸AAAA — IPv6
• ▸CNAME — Alias for another name (www → example.com)
• ▸MX — Mail server
• ▸TXT — Text data (SPF · DKIM and other authentication)
• ▸NS — Name server

Port — 0–65535 (16-bit):

• ▸Well-known (0–1023): 22 (SSH) · 25 (SMTP) · 53 (DNS) · 80 (HTTP) · 443 (HTTPS)
• ▸Registered (1024–49151): 3000 (Node) · 8080 (alternative HTTP) · 5432 (Postgres)
• ▸Dynamic (49152–65535): temporarily assigned by the OS

OSI 7 Layers — communication abstracted into 7 layers:

Practical model (TCP/IP 4 layers):

• ▸Application = OSI 5+6+7
• ▸Transport = 4
• ▸Internet = 3
• ▸Network Access = 1+2

> 💡 No need to memorize. Use it when asking "which layer is the problem at?"

What happens when you type example.com

0. Browser cache → OS cache → Router cache

First, your local computer's cache is checked. If found, the IP is returned immediately. Otherwise, proceed to the next step.

1. Recursive DNS (ISP or 8.8.8.8)

The first server the user directly queries. Operated by your ISP, or by Google 8.8.8.8 / Cloudflare 1.1.1.1.

[My computer] → "What is the IP for example.com?" → [Recursive DNS]

The recursive server handles the remaining steps on your behalf.

2. Root DNS Servers

13 IP groups worldwide. They tell you where the ".com TLD servers" are located.

[Recursive] → "Where are the authoritative servers for com?" → [Root]
[Root] → "com is handled by a.gtld-servers.net, etc."

3. TLD (Top-Level Domain) Servers

Organized by domain extension: .com / .net / .kr, etc. They tell you who the authoritative server is for "example.com".

[Recursive] → "Who is the authoritative server for example.com?" → [.com TLD]
[.com TLD] → "ns1.example.com / ns2.example.com"

4. Authoritative Server

The actual DNS server operated by the domain owner. It truly knows the IP address for "example.com".

[Recursive] → "What is the IP for example.com?" → [ns1.example.com]
[Authoritative] → "93.184.216.34"

5. Cache and Return

The recursive server caches the result (for the TTL duration). The next request gets an immediate response. This is why DNS changes take time to propagate worldwide (until the TTL expires).

5 DNS Record Types

# Records for example.com
A       93.184.216.34
AAAA    2606:2800:220:1:248:1893:25c8:1946
CNAME   www → example.com
MX      10 mail.example.com
TXT     "v=spf1 include:_spf.google.com ~all"

TTL — How long should it be cached?

example.com.    300    IN    A    93.184.216.34
                ^^^
                TTL in seconds

• ▸Short TTL (60–300 seconds): Changes propagate quickly. Higher load ↑
• ▸Long TTL (24 hours): Better cache efficiency ↑. Slower to reflect changes

Before a migration, set a short TTL (5 minutes); once stable, lengthen it (1 hour).

DNS Lookup Commands

# Mac/Linux
dig example.com A
dig example.com NS
dig +trace example.com    # Trace the full delegation chain

nslookup example.com 8.8.8.8

# Windows
nslookup example.com

DNS and CDN

When using a CDN like Cloudflare:

example.com → CNAME → example.com.cdn.cloudflare.net → nearest edge IP

Different IPs returned by region → users are directed to a nearby server → reduced latency.

🤖 Try asking an AI

• ▸"Give me a guide for migrating my domain's DNS to Cloudflare"
• ▸"Interpret the output of dig example.com A for me"
• ▸"Tell me when to set my DNS TTL to 60 seconds before a migration and back to 3600 afterward"